CSteipp has uploaded a new change for review.
https://gerrit.wikimedia.org/r/276518
Change subject: Enforce password policies on labs
......................................................................
Enforce password policies on labs
In preparation for enfocing these policies in production, enforce
password policies in labs, as specified by the policy RFC on meta.
Bug: T119100
Change-Id: I9de88627715e4d5d63e363248bd0591c575f125d
---
M wmf-config/CommonSettings-labs.php
1 file changed, 54 insertions(+), 0 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/mediawiki-config
refs/changes/18/276518/1
diff --git a/wmf-config/CommonSettings-labs.php
b/wmf-config/CommonSettings-labs.php
index b952f90..bf98da9 100644
--- a/wmf-config/CommonSettings-labs.php
+++ b/wmf-config/CommonSettings-labs.php
@@ -355,6 +355,60 @@
$wgMessageCacheType = CACHE_ACCEL;
+// Enforce password policy when users login on other wikis
+if ( $wmgUseCentralAuth ) {
+ $wgHooks['PasswordPoliciesForUser'][] = function( User $user, array
&$effectivePolicy ) {
+ $central = CentralAuthUser::getInstance( $user );
+ if ( !$central->exists() ) {
+ return true;
+ }
+
+ $privilegedPolicy = array(
+ 'MinimalPasswordLength' => 8,
+ 'MinimumPasswordLengthToLogin' => 1,
+ 'PasswordCannotBePopular' => 10000,
+ );
+
+ if ( array_intersect(
+ array( 'bureaucrat', 'sysop', 'checkuser', 'oversight',
'interface-editor' ),
+ $central->getLocalGroups()
+ ) ) {
+ $effectivePolicy = UserPasswordPolicy::maxOfPolicies(
+ $effectivePolicy,
+ $privilegedPolicy
+ );
+ return true;
+ }
+
+ // Result should be cached by getLocalGroups() above
+ $attachInfo = $central->queryAttached();
+ $enforceWikiGroups = array(
+ 'centralnoticeadmin' => array( 'metawiki', 'testwiki' ),
+ 'templateeditor' => array( 'fawiki', 'rowiki' ),
+ 'botadmin' => array( 'frwiktionary', 'mlwiki',
'mlwikisource', 'mlwiktionary' ),
+ 'translator' => array( 'incubatorwiki' ),
+ 'technician' => array( 'trwiki' ),
+ 'wikidata-staff' => array( 'wikidata' ),
+ );
+
+ foreach ( $enforceWikiGroups as $group => $wikis ) {
+ foreach ( $wikis as $wiki ) {
+ if ( isset( $attachInfo[$wiki]['groups'] )
+ && in_array( $group,
$attachInfo[$wiki]['groups'] ) )
+ {
+ $effectivePolicy =
UserPasswordPolicy::maxOfPolicies(
+ $effectivePolicy,
+ $privilegedPolicy
+ );
+ return true;
+ }
+ }
+ }
+
+ return true;
+ };
+}
+
// Test of new import source configuration on labs cluster
$wgImportSources = false;
include( "$wmfConfigDir/import.php" );
--
To view, visit https://gerrit.wikimedia.org/r/276518
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I9de88627715e4d5d63e363248bd0591c575f125d
Gerrit-PatchSet: 1
Gerrit-Project: operations/mediawiki-config
Gerrit-Branch: master
Gerrit-Owner: CSteipp <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
